CVE Database /
CVE-2021-25069
CVE · High
CVE-2021-25069 — Download Manager [download-manager] < 3.2.34
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2021-25069
|
Download Manager [download-manager] < 3.2.34 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
High
8.8
|
< 3.2.34
|
3.2.34 |
2022-01-12 |
—
|
CVE-2021-25069
The Download Manager plugin in versions prior to 3.2.34 contains a SQL injection vulnerability in the package_ids parameter, which is incorporated into database queries without proper sanitization or escaping. This flaw can be exploited to execute arbitrary SQL commands and can additionally be leveraged to perform reflected cross-site scripting attacks against users of the plugin.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings